GitHub Advisoryadvisory · crates.io

GHSA-cvmj-47v9-35m9 FUSE-Rust: Uninitalized memory read and leak caused by fuser crate

HIGH Published 2025-09-15 Modified 2025-09-15 Official page ↗
Ecosystem
crates.io
Packages
fuser
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-908
Reviewed
2025-09-15

Affected packages

• crates.io fuser: < 0.16.0 → fixed in 0.16.0

Description

During the creation of a new libfuse session with `fuse_session_new`, the operation list was passed as NULL incorrectly. libfuse expects this argument to always point to list of operations. This caused uninitialized memory read and leaks in libfuse.so.

Related

Weakness · CWE (1)

  • CWE-908 Use of Uninitialized Resource weakness

References